Spokeo’s Impact: A Potent but Mercurial Class Action Gatekeeper. The Supreme Court’s May 2016 decision in Spokeo, Inc. v. Robins, 136 S. Ct. 1540(2016), as revised (May 24, 2016), promised to rein in the wave of class actions premised on “no injury” statutory violations, where the threat of crippling aggregated damages prompted numerous significant settlements. Spokeo held that a “bare procedural violation” of a statute cannot establish Article III standing, and thus appeared to preclude lawsuits premised on technical violations of federal statutes where no harm resulted. In the six months since Spokeo issued, the decision has had an undeniable effect in limiting such claims. But lower court interpretations have not been uniform, which means that, for now, venue might matter.
In Spokeo, the plaintiff alleged that a “people search engine” that generated credit report information had been disseminating inaccurate personal data in violation of Section 1681(b) of the Fair Credit Reporting Act (FCRA). Spokeo challenged whether these allegations sufficiently pleaded the "injury in fact" required under Article III of the Constitution. The Supreme Court remanded on the sufficiency of those specific allegations, but clarified important aspects of the injury-in-fact analysis in the context of statutory violations.
First, the Court concluded that not all harms statutorily defined by Congress rise to the level of constitutional injury in fact. The Court emphasized that concreteness and particularization are distinct requirements. Spokeo at *6. To be “concrete,” an injury “must be ‘de facto’; that is, it must actually exist.” Id. at *7 (internal citation omitted). The adjective “concrete” is “meant to convey the usual meaning of the term—’real,’ and not ‘abstract.’” Id. Although the Supreme Court agreed that Congress plays a role in identifying “intangible” harms that should be actionable, the harm or risk of harm identified must still constitute a concrete injury in fact to confer standing. Id. at *7. Article III is not “automatically satisfie[d] . . . whenever a statute grants a person a statutory right and purports to authorize that person to sue to vindicate that right.” Id.
Second, the Supreme Court emphasized that the mere violation of a procedural requirement in place to safeguard congressionally recognized harms (even a harm that is sufficiently concrete and particularized) does not independently constitute a cognizable harm. Rather, procedural breaches confer constitutional standing only when they separately entail “a degree of risk sufficient to meet the concreteness requirement.” Id. at *8.
Following Spokeo, defendants facing class actions based on alleged statutory violations were quick to file or renew Article III standing challenges. Of the more than 150 opinions that have since issued, courts found a lack of standing in about 40% of the cases. Much of the variance in results can be attributed to understandable differences in the plausibility of the actual harm allegations, but even among the relatively few of these cases that have already made their way through the Circuit Courts, it is sometimes difficult to identify principled distinctions.
Some courts have not hesitated to conclude that the plaintiff failed to identify “concrete harm” resulting from the defendant’s alleged statutory violation. For example, in Hancock v. Urban Outfitters, Inc., 830 F.3d 511, 514 (D.C. Cir. 2016), the plaintiff asserted a violation of the Consumer Protection Act based on Urban Outfitters’ practice of collecting customers’ zip codes while processing credit card transactions. The D.C. Circuit, relying on Spokeo, concluded that where the plaintiff admitted its only injury was being “asked for a zip code when under the law they should not have been,” the plaintiff had not alleged the requisite “risk of real harm.” Id. The Eighth Circuit reached a similar conclusion in Braitberg v. Charter Communications, Inc., 836 F.3d 925, 927-30 (8th Cir. 2016), dismissing allegations that a cable provider failed to destroy the plaintiff’s personal information in violation of a statute where the plaintiff “identifie[d] no material risk of harm from the retention.”
However, other courts have seized on the fact-intensive nature of the “injury-in-fact” inquiry and the lack of clear guidance from the Supreme Court and have found standing even when confronted with similar fact patterns. The Sixth Circuit in Galaria v. Nationwide Mutual Insurance Co., No. 15-3386, 2016 WL 4728027, at *3 (6th Cir. Sept. 12, 2016), ruled that the plaintiffs need not wait for their information to actually be misused to claim standing. “[A]lthough it might not be literally certain that Plaintiffs’ data will be misused, there is a sufficiently substantial risk of harm.” (internal citations and quotations omitted); see also Remijas v. Neiman Marcus Grp., LLC, 794 F.3d 688, 693 (7th Cir. 2015) (finding standing in a data breach case because, “[p]resumably, the purpose of the hack is, sooner or later, to make fraudulent charges or assume those consumers’ identities.”) Likewise, in Strubel v. Comenity Bank, No. 15-528-CV, 2016 WL 6892197, at *5 (2d Cir. Nov. 23, 2016), the Second Circuit found standing where plaintiff alleged that her bank failed to give her proper notice of certain aspects of her credit card agreement. According to the Second Circuit, because a “consumer who is not given notice of his obligations is likely not to satisfy them,” failure to provide required notice necessarily affects plaintiff “in a personal and individual way.” Id.
In the near term, this lack of consensus means the pleading stage battles over Spokeo will rage on. Plaintiffs will likely seek to file in circuits they perceive as more favorable venues until greater clarity and consistency emerges. But even in just six months, Spokeo has played a profound gatekeeping role with respect to this species of class action, which exposes companies of all types to massive statutory damages.